SC-100 Multiple Select — 40 Questions

Question 1

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 2

A company is designing a Zero Trust security posture for their Azure environment. They need to assess and improve their security posture. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Azure Policy to enforce security configurations. Azure Policy enforces organizational standards and assesses compliance at scale, which is a core Zero Trust principle of continuous verification and policy-driven access control. By applying policies that enforce security configurations (e.g., requiring HTTPS, restricting public network access), the company can proactively prevent misconfigurations and maintain a consistent security baseline across their Azure environment.

Answer

Enable Azure Update Management for all VMs

Answer

Deploy Microsoft Entra Permissions Management

Answer

Use Microsoft Security Copilot to generate security policies

Question 3

A large enterprise is implementing Microsoft Defender for Cloud to improve their security posture. Which TWO actions should they take to prioritize and remediate security recommendations effectively? (Choose two.)

Accepted Answer

Enable automatic remediation for high-priority recommendations. Option B is correct because Microsoft Defender for Cloud allows you to enable automatic remediation for high-priority recommendations, which automatically applies the necessary configuration changes (e.g., enabling encryption or installing endpoint protection) when a recommendation is triggered. This reduces manual effort and ensures critical security gaps are closed quickly. Option C is correct because the Secure Score aggregates all recommendations into a numerical score, and focusing on recommendations that provide the highest score improvement directly correlates to the most significant risk reduction, aligning with Microsoft's guidance for prioritization.

Answer

Assign each recommendation to a specific team member manually

Answer

Ignore recommendations with low severity to save time

Answer

Disable recommendations that generate security alerts

Question 4

A company has a Microsoft Sentinel workspace that ingests data from multiple sources. The SOC team wants to improve the efficiency of investigating incidents by using UEBA capabilities. Which two actions should the team take to enable and configure UEBA in Sentinel?

Accepted Answer

Set the entity behavior analytics to 'Active' in the Sentinel configuration.. Options B and D are correct. Enabling UEBA is done per workspace (B). Setting the entity behavior analytics to 'Active' enables the feature (D). Option A is incorrect because UEBA is not a data connector; it's a feature enabled in the workspace settings. Option C is incorrect because the analytics rule for UEBA is not a separate rule; UEBA is enabled at the workspace level. Option E is incorrect because time range selection is not part of enabling UEBA; it's part of analytics rule configuration.

Answer

Install the UEBA data connector from the Sentinel content hub.

Answer

Create an analytics rule that uses the UEBA template.

Answer

Define a time range for entity behavior baselines.

Question 5

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

Accepted Answer

Disable public access and configure a service endpoint with a firewall rule for the VPN subnet. Option C is correct because disabling public access ensures the storage account is not reachable from the internet, and configuring a service endpoint with a firewall rule for the VPN subnet restricts traffic to only the on-premises data center traffic arriving via the VPN. Service endpoints provide an optimized route over the Azure backbone, and the firewall rule explicitly allows the VPN subnet's IP range, preventing data exfiltration from unauthorized networks.

Answer

Enable firewall and add on-premises IP range

Answer

Disable public access and use RBAC

Question 6

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Option A is correct because enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows, rather than relying on manual checks.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 7

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Enable Azure AD integration for Kubernetes RBAC.. Option A is correct because integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.

Answer

Disable HTTP application routing.

Answer

Enable Azure Firewall to restrict outbound traffic.

Answer

Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.

Question 8

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Accepted Answer

VPN gateway (route-based). A route-based VPN gateway (option C) is required for site-to-site VPN connections because it uses dynamic routing (BGP) and supports IKEv2, enabling automatic failover and policy-based traffic selectors. This is essential for secure hybrid networking as it allows Azure to route traffic to on-premises networks via the VPN tunnel without static route limitations.

Answer

Public IP address for the VPN device

Answer

ExpressRoute circuit

Question 9

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection

Question 10

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 11

A company is designing a secure DevOps pipeline for deploying Azure App Service applications. They need to ensure that secrets are not exposed in source code. Which TWO practices should they implement?

Accepted Answer

Use Azure Key Vault references in App Service application settings. Option A is correct because Azure Key Vault references allow App Service to securely retrieve secrets (e.g., connection strings, API keys) at runtime without storing them in source code or configuration files. The reference syntax @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/) is resolved by the App Service platform, ensuring secrets are never exposed in the repository or build artifacts.

Answer

Implement Git pre-commit hooks to scan for secrets

Answer

Store secrets in Azure DevOps library variable groups

Answer

Use Azure Policy to audit for secret exposure

Question 12

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Use Azure AD integration for authentication. Azure AD integration for AKS enables role-based access control (RBAC) using Azure AD identities, allowing fine-grained permissions for cluster operations. This eliminates the need for shared static credentials and supports conditional access policies, multi-factor authentication, and audit logging via Azure AD sign-in logs. It is a foundational security best practice for identity management in Kubernetes clusters.

Answer

Deploy all applications in the default namespace

Answer

Use service principals instead of managed identities for pod identity

Answer

Enable SSH access to all worker nodes for troubleshooting

Question 13

Which THREE of the following are key components of a defense-in-depth strategy?

Accepted Answer

Physical security. Physical security is a foundational layer in defense-in-depth, protecting hardware assets from unauthorized physical access, theft, or tampering. It includes measures like biometric locks, surveillance cameras, and secure server rooms, which prevent attackers from bypassing logical controls by directly interacting with systems.

Answer

Flat network topology

Answer

Single sign-on (SSO)

Question 14

A company wants to improve their security posture by using Microsoft Defender for Cloud. Which TWO of the following are features of Defender for Cloud that help with governance and compliance?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Defender for Cloud provides continuous monitoring of your Azure and hybrid workloads against industry standards like SOC 2, ISO 27001, PCI DSS, and Azure CIS. It dynamically tracks compliance posture over time, highlights non-compliant resources, and maps controls to specific assessments, directly supporting governance and compliance workflows.

Answer

Azure Blueprints

Answer

Azure Policy

Answer

Microsoft Sentinel

Question 15

A company uses Microsoft Sentinel for threat detection. They want to use User and Entity Behavior Analytics (UEBA) to detect anomalies. Which THREE of the following are key components of UEBA in Sentinel?

Accepted Answer

UEBA analytics rules that baseline normal behavior.. Option A is correct because UEBA in Microsoft Sentinel relies on analytics rules that establish a baseline of normal behavior for users and entities. These rules use machine learning to detect deviations from the established baseline, enabling the identification of anomalous activities such as unusual sign-in locations or data exfiltration attempts.

Answer

Playbooks for automated response to anomalies.

Answer

Azure AD sign-in logs

Question 16

A company is designing a security operations center (SOC) using Microsoft Sentinel. Which TWO of the following are best practices for managing incident response in Sentinel?

Accepted Answer

Use automation rules and playbooks to automate common response actions.. Option B is correct because automation rules and playbooks in Microsoft Sentinel allow you to automate common incident response actions, such as triggering investigations, sending notifications, or running remediation scripts. This reduces manual effort, ensures consistent response, and accelerates mean time to respond (MTTR), which is a core best practice for SOC operations.

Answer

Create multiple Sentinel workspaces for each incident type.

Answer

Manually classify all incidents to ensure accuracy.

Answer

Use a single data connector for all log sources.

Question 17

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Accepted Answer

Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.. Option B is correct because Zero Trust mandates least privilege access, and Microsoft 365 Defender integrates with Azure AD Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. This ensures users receive only the permissions necessary for a specific task, for a limited duration, reducing the risk of lateral movement and privilege escalation.

Answer

Trust all traffic originating from within the corporate network.

Answer

Provide implicit trust to known users and devices.

Question 18

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Enable Azure Policy for AKS. A is correct because Azure Policy for AKS enforces organizational standards and assesses compliance at scale by applying built-in policies that restrict privileged containers, require pod security standards, and enforce HTTPS ingress. This reduces the attack surface and ensures clusters adhere to security baselines without manual intervention.

Answer

Store secrets in Kubernetes secrets

Answer

Allow all node pools to communicate freely

Question 19

Which TWO of the following are true about Azure Policy initiatives?

Accepted Answer

Initiatives can be assigned to management groups, subscriptions, or resource groups. Azure Policy initiatives (also known as policy sets) are designed to group multiple policy definitions together to achieve a common compliance goal. They can be assigned at the management group, subscription, or resource group scope, which allows for broad or granular enforcement of compliance rules across the Azure hierarchy.

Answer

Initiatives cannot be assigned to a management group

Answer

An initiative can only contain one policy definition

Answer

Initiatives are predefined and cannot be customized

Question 20

Which TWO of the following are valid methods to secure traffic between on-premises and Azure?

Accepted Answer

ExpressRoute with MACsec. ExpressRoute with MACsec provides encryption at Layer 2 using the IEEE 802.1AE standard, securing traffic between on-premises and Azure over a private connection without traversing the public internet. Site-to-Site VPN uses IPsec (IKEv1/IKEv2) to encrypt traffic over the public internet, establishing a secure tunnel between the on-premises VPN device and Azure VPN Gateway. Both are valid methods for securing traffic, with ExpressRoute+MACsec offering lower latency and higher throughput for private connectivity.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure CDN